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In the Claims 

1.-60 (cancelled) 

61 . (New) A method for providing access to a computer network, 
comprising: 

mutually authenticating, via a wireless connection, a client device and 
a wireless access point using message digests to perform a shared secret key 
exchange to produce an authenticated client device and a key; and 

authenticating, via the access point, a user of the authenticated client 
device to an authentication server using the key and Extensible 
Authentication Protocol-Transport Layer Security. 

62. (New) The method of claim 1, wherein the mutually authenticating 
includes a shared secret key exchange between the unauthenticated client 
device and the wireless access point. 

63. (New) A method for providing authenticated access to a controlled 
network, comprising: 

first authenticating a wireless access point to an unauthenticated client 
device communicatively coupled to the wireless access point via a wireless 
connection; 

second authenticating the unauthenticated client device to the wireless 
access point to produce an authenticated client device and a key: 

third authenticating, via the wireless access point, a user of the 
authenticated client device to a central authentication server using the key. 
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64. (New) The method of claim 63 wherein the first authenticating and the 
second authenticating comprise a shared secret key exchange between the 
wireless access point and the unauthenticated client device. 

65. (New) The method of claim 63, wherein the first authenticating further 
comprises: 

receiving a first message from said unauthenticated client device at 
said wireless access point, said first message including a device identifier 
and a first random number; 

receiving a second message from said wireless access point at said 
unauthenticated client device, said second message including a second 
random number and a first digest, said first digest including a one-way hash 
function operating on said first random number, said device identifier, and a 
first secret shared between said wireless access point and said 
unauthenticated client device; 

determining a second digest at said unauthenticated client device, said 
second digest comprising a one-way hash function operating on said first 
random number, said device identifier, and said first secret; 

comparing said first digest to said second digest at said 
unauthenticated client device; and 

provided said first digest matches said second digest, authenticating 
said wireless access point to said unauthenticated client device. 

66. (New) The method of claim 65 wherein the second authenticating further 
comprises: 

receiving a third message from said unauthenticated client device at 
said wireless access point, said third message including a third digest, said 
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third digest including a one-way hash function operating on said second 
random number, said device identifier, and said first secret; 

determining a fourth digest at said wireless access point, said fourth 
digest comprising said second random number, said device identifier, and 
said first secret; 

comparing said third digest to said fourth digest at said 
unauthenticated client device; and 

provided said third digest matches said fourth digest, authenticating 
said client device to said wireless access point to produce the authenticated 
client device. 

67. (New) The method of claim 65, further comprising: 

determining a fifth digest at said wireless access point, said fifth 
digest comprising said device identifier received from said authenticated 
client device, said first secret, said first random number, and said second 
random number, said fifth digest from which said wireless access point 
selects bits and determines said key; and 

calculating a sixth digest at said client device, said sixth digest comprising 
said device identifier, said first secret, said first random number and said 
second random number, said sixth digest from which said authenticated 
client device selects bits and determines said key. 

68. (New) The method of claim 63, wherein said third authenticating 
comprises: 

receiving, at the authenticated client device via the wireless access 
point, a request originating from a central authentication server for a 
username and a usercredentials, 
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transmitting said userjiame and said user_credentials to said wireless 
access point from said authenticated client device; 

forwarding said userjiame and said user credentials to said central 
authentication server from said wireless access point; and 

employing said userjiame and said user credentials for 
authenticating said user at said central authentication server. 

69. (New) A computer-useable medium having computer-readable code 
embodied thereon that is executed by a computer to implement the method 
of authenticating an unauthenticated client device and a network access 
point, said method comprising: 

first authenticating a wireless access point to an unauthenticated client 
device communicatively coupled to the wireless access point via a wireless 
connection; 

second authenticating the unauthenticated client device to the wireless 
access point to produce an authenticated client device and a key; 

third authenticating, via the wireless access point, a user of the 
authenticated client device to a central authentication server using the key. 

70, The computer-useable medium recited in claim 69, wherein the method 
of authenticating an unauthenticated client device and a network access 
point further comprises: 

receiving a first message from said unauthenticated client device at 
said wireless access point, said first message including a device identifier 
and a first random number; 

receiving a second message from said wireless access point at said 
unauthenticated client device, said second message including a second 
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random number and a first digest, said first digest including a one-way hash 
function operating on said first random number, said device identifier, and a 
first secret shared between said wireless access point and said 
unauthenticated client device; 

determining a second digest at said unauthenticated client device, said 
second digest comprising a one-way hash function operating on said first 
random number, said device identifier, and said first secret; 

comparing said first digest to said second digest at said 
unauthenticated client device; and 

provided said first digest matches said second digest, authenticating 
said wireless access point to said unauthenticated client device. 

71. (New) The computer-useable medium recited in claim 70, wherein the 
method of authenticating an unauthenticated client device and a network 
access point further comprises:: 

receiving a third message from said unauthenticated client device at 
said wireless access point, said third message including a third digest, said 
third digest including a one-way hash function operating on said second 
random number, said device identifier, and said first secret; 

determining a fourth digest at said wireless access point, said fourth 
digest comprising said second random number, said device identifier, and 
said first secret; 

comparing said third digest to said fourth digest at said 
unauthenticated client device; and 

provided said third digest matches said fourth digest, authenticating 
said client device to said wireless access point to produce the authenticated 
client device. 
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72. (New) The computer-useable medium recited in claim 71, wherein the 
method of authenticating an unauthenticated client device and a network 
access point further comprises:: 

determining a fifth digest at said wireless access point, said fifth 
digest comprising said device identifier received from said authenticated 
client device, said first secret, said first random number, and said second 
random number, said fifth digest from which said wireless access point 
selects bits and determines said key; and 

calculating a sixth digest at said client device, said sixth digest 
comprising said device identifier, said first secret, said first random number 
and said second random number, said sixth digest from which said 
authenticated client device selects bits and determines said key. 

73. (New) The method of claim 69, wherein said third authenticating 
comprises: 

receiving, at the authenticated client device via the wireless access 
point, a request originating from a central authentication server for a 
userjiame and a user_credentials, 

transmitting said user__name and said user_credentials to said wireless 
access point from said authenticated client device; 

forwarding said userjaame and said user__credentials to said central 
authentication server from said wireless access point; and 
employing said userjntame and said usercredentials for authenticating said 
user at said central authentication server. 
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